T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:554- Finding
Promotional Referral Instructions Hijack Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Wanpaike Opc Tech Due Diligence
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches technical due diligence, but it asks agents to use credentialed knowledge-base read/write workflows and includes promotional referral instructions that users should review before installing.
Install only if you are comfortable with a Chinese-language due-diligence workflow that may process sensitive company, founder, patent, financial, and BP materials. Before using the IMA mode, confirm where documents and reports will be stored, who can access them, how long they are retained, and whether the API key is least-privilege. Remove or ignore the promotional referral section if you need neutral reports, and pin dependencies before running the local Node.js generator.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:617- Finding
Unpinned npm Dependency Enables Non-Reproducible Package Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (40)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation only checks for presence of headings/fields in a report rather than performing real verification, the skill can produce outputs that look like completed due diligence without any evidentiary basis. In this context, that is dangerous because it can legitimize unsupported investment conclusions and obscure the absence of actual technical or patent validation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation only checks for presence of headings/fields in a report rather than performing real verification, the skill can produce outputs that look like completed due diligence without any evidentiary basis. In this context, that is dangerous because it can legitimize unsupported investment conclusions and obscure the absence of actual technical or patent validation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation only checks for presence of headings/fields in a report rather than performing real verification, the skill can produce outputs that look like completed due diligence without any evidentiary basis. In this context, that is dangerous because it can legitimize unsupported investment conclusions and obscure the absence of actual technical or patent validation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation only checks for presence of headings/fields in a report rather than performing real verification, the skill can produce outputs that look like completed due diligence without any evidentiary basis. In this context, that is dangerous because it can legitimize unsupported investment conclusions and obscure the absence of actual technical or patent validation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation only checks for presence of headings/fields in a report rather than performing real verification, the skill can produce outputs that look like completed due diligence without any evidentiary basis. In this context, that is dangerous because it can legitimize unsupported investment conclusions and obscure the absence of actual technical or patent validation.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document explicitly states 'technical due diligence does not do BP,' but the workflow later requires BP modification advice. This internal contradiction can confuse operators about what the skill is authorized and qualified to do, making misuse more likely and weakening trust in all boundary controls.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a tool for technical feasibility assessment, team background checks, patent verification, and business model analysis. This file instead only opens a local .docx file, adjusts paragraph and table formatting, and saves the document in place, which is a document layout utility rather than a due-diligence analysis capability.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs background checks and external searches on team members without any warning or controls for personal data handling, lawful basis, minimization, or retention. In a due-diligence setting this raises real privacy and compliance risk, especially if operators collect, copy, or process sensitive personal information beyond what is necessary.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill expands from technical authenticity screening into BP rewriting and financing-term advice, which exceeds its stated scope. Scope creep is risky because users may assume the same diligence rigor applies to adjacent advisory functions that may be unsupported, biased, or inappropriate for the tool's purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow recommends importing project materials into an IMA knowledge base without any warning about confidentiality, consent, access control, retention, or whether the uploaded materials contain trade secrets or personal data. This is more dangerous in a due-diligence context because source materials may include investor decks, technical documents, employee information, or other highly sensitive non-public content.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring presents the skill's purpose, usage, and output entirely in Chinese, implying a fixed language/locale for interaction and generated reports. There is no natural-language indication that users may choose another language or that the Chinese-only behavior is required for a region-specific compliance context.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code presents itself as a technical due-diligence skill, including team background checks, patent verification, and feasibility assessment, but it only formats caller-supplied findings into a polished report. This creates a deceptive trust boundary: downstream users may rely on the output as if independent verification occurred, enabling false claims, investment misjudgments, or laundering of unverified assertions into authoritative-looking artifacts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill is presented as an initial due-diligence screening tool, but this section instructs the agent to import customer source documents into IMA, creating persistent storage of potentially sensitive files. That expands the action scope from analysis to data ingestion without an explicit trust boundary, consent check, or data-handling warning, which can lead to unintended retention of proprietary or confidential materials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow tells the agent to import customer documents and later persist generated outputs, but it does not warn that those materials may contain confidential, personal, or proprietary information that will be stored in a knowledge base. The absence of disclosure and controls around persistence, downstream access, and retention creates a real data-governance and privacy risk in the context of investment due diligence, where documents are often highly sensitive.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section directs the agent to append the generated due-diligence report back into the IMA knowledge base, which is an external write operation rather than pure evaluation. Reports may contain sensitive assessments, third-party data, or confidential business conclusions, so automatic write-back can create unauthorized persistence, oversharing, or later misuse if the destination document or audience is not tightly controlled.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document instructs the skill to obtain IMA credentials from SECRET.md or environment variables, granting it access to authenticated external systems. In a skill whose primary purpose is due-diligence analysis, broad credential access increases risk because prompt- or workflow-driven actions could use those secrets for data access and modification beyond what the user expects, especially when combined with search, import, and append APIs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents all guidance in Chinese and does not provide an opt-in, translation option, or explanation that the content is intended only for a Chinese-speaking or China-specific audience. Under the language/locale policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance in Chinese only, with no indication that the skill is region-specific or that users may opt into another language, which can amount to forcing a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is entirely written in Chinese and does not offer any language or locale choice, despite being a general-purpose industry evaluation template rather than a clearly region-specific compliance artifact. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire document is written in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file is entirely written in Chinese, beginning with the title at L001, and does not indicate that the language is optional, selectable, or limited to a justified region-specific use case. Under the stated policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s user-facing instructions and generated document content are written entirely in Chinese, and the script hardcodes Chinese report text throughout without any opt-in or configurable locale selection. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module docstring is entirely in Chinese and presents the skill as operating under a Chinese-language convention, without offering any language or locale choice. This is reinforced by user-facing print strings later in the file, suggesting the skill assumes a specific language by default rather than obtaining user opt-in or documenting a justified locale restriction.
- Content